PRIVACY POLICY

Last updated: 20 October 2026

HEYBA respects your privacy.

This Privacy Policy explains what personal information we collect, why we use it, who we may share it with and what rights you have.

HEYBA Surf Discovery AB (“HEYBA”, “we”, “us”) is the data controller for the personal data described in this policy.

Company: HEYBA Surf Discovery AB
Registered office: Stockholm, Sweden
Organisation number: 5596034875
Email: [email protected]
Website: surfheyba.com

WHAT INFORMATION DO WE COLLECT?

The information we collect depends on how you interact with HEYBA.

It may include:

• your name
• email address
• phone number
• city or country
• information about your surfing level
• which trip or departure you are interested in
• information about people you are travelling with
• messages you send us by email, SMS or WhatsApp
• event or gathering registrations
• membership information
• booking and payment information
• information required to organise a trip
• information about how you use our website
• IP address, device and browser information
• advertising and campaign information
• photos or video from HEYBA trips and gatherings, where applicable

If you book a trip, we may also need additional information reasonably required to organise your journey.

Please do not send us sensitive personal information unless it is relevant and we have asked for it.

TRIP APPLICATIONS & INTEREST REGISTRATIONS

When you apply for a HEYBA trip or register your interest in a future trip, we use your information to:

• respond to your application
• understand your surfing experience
• understand which dates interest you
• communicate with you about the trip
• decide together whether the trip feels like a suitable fit
• answer questions
• offer you a place if one becomes available

For applications, we generally process this information because you have asked us to take steps before potentially entering into a booking agreement.

Some trips, such as first or invite-only departures, may only have a limited number of places. Applications are reviewed by people at HEYBA. We do not use solely automated decision-making to decide who can join a trip.

BOOKINGS & TRAVEL

If you choose to join a trip, we use your personal information to organise and deliver it.

This may include:

• confirming your booking
• arranging accommodation
• organising transport and activities
• communicating important trip information
• coordinating with local partners
• handling payments
• providing support before and during the trip

The legal basis for this processing is normally that it is necessary to perform our agreement with you or take steps you have requested before entering into that agreement.

Where required by law, we may also process certain information to comply with legal obligations.

HEALTH, DIETARY OR ACCESSIBILITY INFORMATION

Sometimes there may be information we need to know to organise a trip safely or accommodate a particular need.

This could include dietary requirements, allergies, accessibility needs or relevant health information.

We only ask for this where it is genuinely useful or necessary. Where information is considered sensitive personal data under GDPR, we will use an appropriate legal basis and, where required, ask for your explicit consent.

We do not use this information for advertising.

We aim to delete sensitive travel-related information once it is no longer needed.

HEYBA MEMBERSHIP

If you become a HEYBA member, we use your contact information to provide the things you signed up for.

That may include:

• hearing about new trips first
• invitations to gatherings
• Field Notes and stories
• HEYBA news and updates
• selected opportunities or member information

You can unsubscribe from marketing communications at any time.

Where these communications are based on your consent, you can withdraw that consent whenever you want.

Leaving the mailing list does not prevent you from travelling with HEYBA or attending activities where registration is otherwise available.

EVENTS & GATHERINGS

If you register for a HEYBA gathering or event, we may use your details to:

• manage your registration
• communicate practical information
• manage capacity or waiting lists
• contact you if something about the event changes

Signing up for an event does not automatically mean that you have agreed to receive unrelated marketing unless that is clearly stated and you have been given the appropriate choice.

EMAIL, SMS & WHATSAPP

We use email, SMS and WhatsApp to communicate with people who apply for trips, book trips, join HEYBA or otherwise ask to hear from us.

For example, after submitting a Ghana trip application, we may send you an SMS asking you to complete a few questions by text or WhatsApp.

If you choose WhatsApp, your communication will also be subject to WhatsApp/Meta’s own privacy terms.

We may use service providers such as Brevo to manage email, SMS, contact information and automated communications.

MARKETING

With your permission, we may send you information about:

• HEYBA trips
• new destinations
• gatherings
• Field Notes
• community activities
• other relevant HEYBA news

You can unsubscribe at any time using the unsubscribe link in an email or by contacting us.

We may keep a minimal record that you have unsubscribed so that we can respect your choice in the future.

WEBSITE ANALYTICS

With your consent, we use analytics tools such as Google Analytics to understand how people use surfheyba.com.

This may include information about:

• which pages you visit
• where you arrived from
• which buttons or links you interact with
• device and browser type
• approximate location
• website performance

We use this information to improve the website and understand what content is useful.

See our Cookie Policy for more information.

ADVERTISING

With your consent, we may use advertising and measurement tools from providers including:

• Meta
• Google
• Reddit, if used in the future
• other advertising platforms we may introduce later

These tools may help us understand whether advertising resulted in things such as a trip application, membership signup or website visit.

They may also allow advertising platforms to show HEYBA advertising to people who have previously interacted with our website or similar audiences.

Advertising technologies are only used in accordance with your cookie choices where consent is required.

HEYBA does not sell your personal information to advertisers.

See our Cookie Policy for more information about cookies, pixels and advertising technologies.

PAYMENTS

If you pay for a HEYBA trip or another service, your payment may be processed by a third-party payment provider such as Stripe.

We normally do not receive or store your complete payment-card details ourselves.

We may retain information about your payment, transaction and booking where necessary for accounting, customer service and legal obligations.

PHOTOS & VIDEO

Surf trips and HEYBA gatherings may be photographed or filmed.

Where identifiable images are intended for marketing or other public use, we will handle them in accordance with applicable data-protection rules and tell participants where appropriate.

If you have a concern about an identifiable photo or video of you, contact us.

INFORMATION ABOUT FRIENDS OR GROUP MEMBERS

If you apply as a group, you may give us basic information about the people you hope to travel with.

Please only provide information that is reasonably necessary for the application.

We may also receive your details from a friend who is organising a group trip. If that happens, we will use the information for the relevant trip enquiry and provide you with information about our privacy practices when appropriate.

WHO DO WE SHARE INFORMATION WITH?

We only share personal data where there is a reason to do so.

Depending on how you use HEYBA, this may include:

• website and hosting providers
• Brevo and other communication/CRM providers
• payment providers
• accounting and administrative providers
• Google, Meta and advertising providers where you have consented
• accommodation providers
• local surf guides
• transport providers
• activity providers
• other local travel partners where required to organise your trip
• professional advisers
• authorities where disclosure is required by law

We only aim to give partners the information they reasonably need for their role.

INTERNATIONAL TRANSFERS

HEYBA is based in Sweden, but some of our service providers and travel partners operate outside the EU/EEA.

For example, a trip to Ghana or Angola may require certain information to be shared with accommodation, transport or other local partners in that country.

Digital providers may also process information outside the EU/EEA.

Where GDPR requires safeguards for an international transfer, we use an applicable transfer mechanism, such as an adequacy decision, standard contractual clauses or another permitted mechanism.

We also limit the information shared to what is reasonably necessary.

HOW LONG DO WE KEEP YOUR INFORMATION?

We do not want to keep personal information indefinitely.

As a general guide:

Trip applications that do not become bookings
Normally kept for up to 12 months after the last meaningful contact, unless you have separately chosen to remain a HEYBA member or receive updates.

Interest registrations
Normally kept while the relevant trip or opportunity remains active and for a reasonable follow-up period afterwards.

HEYBA membership and marketing
Kept while you remain subscribed. If you unsubscribe, we may retain limited information needed to make sure we respect that choice.

Event registrations
Normally kept for up to 12 months after the event, unless the information is also relevant to your membership or another relationship with HEYBA.

Messages and enquiries
Normally kept for up to 24 months after the last contact, unless they form part of a booking, dispute or other matter that requires longer retention.

Travel-related sensitive information
Kept only for as long as it is reasonably needed for the relevant trip or legal requirement.

Booking, payment and accounting records
Kept for the periods required by Swedish law. Swedish accounting records generally have to be retained for seven years after the end of the relevant calendar year. Skatteverket

Analytics and advertising data
Kept according to our cookie settings and the retention periods of the relevant providers. See our Cookie Policy.

We may keep information for longer if necessary to establish, exercise or defend legal claims or comply with a legal obligation.

OUR LEGAL BASES

Depending on the situation, we process personal data because:

Contract
It is necessary to take steps you request before booking or to provide a trip or service you have booked.

Consent
You have chosen to receive marketing, allow analytics or advertising cookies, or have otherwise explicitly agreed to a particular use.

Legitimate interests
We have a reasonable business need, such as answering enquiries, operating and protecting our website, improving our services or managing our relationship with customers, provided your rights do not override that interest.

Legal obligation
We are required to keep or process information under applicable law, for example accounting information.

IMY requires organisations to identify and communicate the legal basis they rely on rather than simply collecting information because it may be useful. IMY

YOUR RIGHTS

Under GDPR, you may have the right to:

• ask what personal data we hold about you
• receive a copy of your personal data
• correct inaccurate information
• ask us to delete information in certain circumstances
• restrict certain processing
• object to processing based on legitimate interests
• withdraw consent at any time
• receive certain information in a portable format
• object to direct marketing

Withdrawing consent does not make earlier processing unlawful.

These rights are subject to the conditions and exceptions in GDPR. IMY

To exercise a right, email us at [PRIVACY EMAIL].

We may need to confirm your identity before acting on a request.

COMPLAINTS

If you believe we have handled your personal data incorrectly, please contact us first so we can try to resolve it.

You also have the right to make a complaint to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). IMY

SECURITY

We take reasonable technical and organisational measures to protect personal information from unauthorised access, loss, alteration or disclosure.

No internet service can guarantee absolute security, but we aim to collect only what we need and give access only where there is a legitimate reason.

CHILDREN

HEYBA trips are intended for adults aged 18 and over.

We do not knowingly collect personal information from children for trip bookings.

CHANGES TO THIS POLICY

We may update this Privacy Policy as HEYBA develops, for example when we introduce new destinations, services or technology providers.

The latest version will always be published on surfheyba.com with the date of the most recent update.

Material changes will be communicated where appropriate.

CONTACT US

Questions about your personal information or this policy?

HEYBA Surf Discovery AB
Stockholm, Sweden
Email: [email protected]
Website: surfheyba.com